"The model does not retain training data" is a testable claim, and someone else runs the test

Start with the test, because it is cheap. Membership inference, formalised in the security literature in 2017 and refined heavily since, presents a model with a record and measures whether the answer carries the tell-tale over-confidence of something it has seen before ^[9]. That signal exists because trained examples draw systematically higher confidence and lower prediction error than otherwise-similar examples the model never saw ^[7]. The dev.to write-up treats this as the shared mechanism under the copyright complaints and the privacy research alike ^[4], and it is worth being precise about why it happens: the objective rewards predicting a training example accurately, and memorising the example is one effective way to do that ^[5].

The consequences are unevenly distributed. On the privacy side the leak is often not the content at all. A model trained on records from a clinic that treats one condition will, for a named person, confirm that they were a patient there ^[10]. Nothing has to be reproduced for that harm to land, which is why "we only learned general patterns" ^[1] answers a question nobody is asking.

Mitigation has one honest lever and one blind spot. Because the gap widens with duplicate count, cutting duplicate copies of a record cuts the measurable signal attached to it ^[2]. That does nothing for the other case the piece names, where a single example in an unusual form gets memorised because memorising it was the optimiser's cheapest route to predicting it ^[6]. Rare and oddly-formatted is exactly the shape of the record that hurts when it comes back out.

And it does come back out. Early demonstrations pulled verbatim training text from language models, including names and phone numbers that had been posted online ^[12]. The scaled-up version sometimes needed nothing cleverer than driving the model into a repetitive failure mode until it spilled ^[13]. In images the artefact is harder still to argue away, because a regenerated training picture is a reconstruction of one specific example rather than a blend of many ^[14].

The operating position that follows is narrow. You cannot demonstrate that a set of weights forgot something, since there is no experiment for absence. A third party can demonstrate that the weights did not forget, holding only a candidate record and your deployed endpoint ^[1]. So a non-retention line in a datasheet, a DPA, or a customer questionnaire is an empirical claim about a shipped artefact ^[3], and the only document that helps you when it is challenged is the one that lists what went in.